A critical vulnerability in the Wishlist Member WordPress plugin allows unauthenticated attackers to hijack user accounts, including administrator accounts, posing a severe risk to site integrity.

This flaw exists in the wpm_register() function, which fails to verify user registration data authenticity. An unauthenticated attacker can supply an arbitrary numeric user ID to overwrite account credentials and details without triggering security notifications.

The ability for an unauthenticated attacker to seize control of an administrator account grants them total access to the WordPress environment. Given the 9.8 CVSS score, this represents a critical threat that can lead to complete site compromise, data exfiltration, and the deployment of malicious content, resulting in significant operational and reputational damage.

Immediate Action: Update the Wishlist Member plugin to the latest version immediately to resolve the authentication bypass flaw.

Proactive Monitoring: Review user account modification logs for suspicious activity, particularly changes to administrator emails or credentials.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block suspicious registration attempts or malformed POST requests targeting the wpm_register function.

Public Exploit Available: No

This vulnerability is critical and requires immediate attention. Administrators must update the Wishlist Member plugin to the latest release to eliminate this account takeover path. Failure to patch allows attackers to gain full administrative control over the affected WordPress site.